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Abstract 

The early promises of DNA computing to deliver a mas- 
sively parallel architecture well-suited to computation- 
ally hard problems have so far been largely unkept. In- 
deed, it is probably fair to say that only toy problems 
have been addressed experimentally. Recent experi- 
mental development on algorithmic self-assembly using 
DNA tiles seem to offer the most promising path toward 
a potentially useful application of the DNA computing 
concept. In this paper, we explore new geometries for 
algorithmic self-assembly, departing from those previ- 
ously described in the literature. This enables us to 
carry out mathematical operations like binary multi- 
plication or cyclic convolution product. We then show 
how to use the latter operation to implement an at- 
tack against the well-known public-key crypto system 
NTRU. 

Keywords: DNA, self-assembly, 
multiplication, convolution product, 
cryptanalysis, NTRU, Wang tiles 

1 Introduction 

Since the seminal work of Adleman on the Traveling 
Salesman Problem (TSP) [^|, DNA computing has re- 
ceived a lot of attention both from a theoretical point of 
view j(| and from an experimental perspective pO| 
By using the DNA molecule as a carrier of non-genetic 
information, and biochemistry as a way to process this 
information, it is possible to build a massively paral- 
lel computing architecture. The implementation details 
vary from one experimental approach to another, but 
it is certainly fair to describe the overwhelming major- 
ity of the reported experiences in the following way: 
DNA molecules are used to represent potential solu- 
tions and biochemical reactions are used to test whether 
these solutions satisfy or not the criteria for being an 
actual solution of the problem. Even though a single 



biochemical step can take as much as one day to per- 
form, the number of solutions tested in parallel is of the 
order of the Avogadro number (that is 10 23 molecules) , 
opening interesting computational perspectives. Sev- 
eral authors have described how DNA computing could 
be used to solve difficult problems like boolean satisfia- 
bility H . Adleman himself has proposed an application 
to crack the DES encryption scheme |jj . DES is a stan- 
dard symmetric encryption algorithm with a key of 56 
bits, and a few test tubes of DNA would be enough 
to carry out a brute force attack on this cipher. Un- 
fortunately, these approaches suffer from a number of 
drawbacks: (1) they are not always easy to implement 
in biochemistry, especially because they require purifi- 
cation steps; (2) they rely essentially on brute force 
because they do not easily make use of additional in- 
formation that might be available about the problem. 
The price to pay for massive parallelism is a restricted 
flexibility in "programming" the DNA molecules. For 
cryptographic applications, this means that the "tradi- 
tional" approach cannot take advantage of the known 
attacks on the weaknesses of a given algorithm. 

Mao et al. Q have recently shown that some de- 
gree of flexibility can be introduced in DNA computing 
while retaining the intrinsic advantage of massive par- 
allelism. For that purpose they used DNA tiles that 
are a biochemical implementation of the mathematical 
concept of Wang tiles iLJQ . We will describe these ob- 
jects in more detail in Section 2. Suffice it to say for 
now that the algorithmic self-assembly of Wang tiles 
is Turing Universal and that Mao et al. demonstrated 
the experimental feasibility of this concept. We feel 
that it is therefore appropriate to investigate in more 
detail to what extent the algorithmic self-assembly of 
DNA tiles can be used to solve problems that could 
not be practically solved using the "traditional" ap- 
proach based on the self-assembly of linear DNA. In 
what follows, we demonstrate in particular that binary 
multiplication and cyclic convolution product are rela- 
tively straightforward to implement (Section 3). Fur- 
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thermore, we show that the practical implementation 
of our ideas requires the creation of a finite number 
of tiles well within the reach of current combinatorial 
chemistry. Finally we discuss how our ideas could be 
used to implement a cryptanalytic attack on the well- 
known public- key crypto system NTRU (Section 4). 

2 Algorithmic Self- Assembly 

2.1 Wang Tiles 

The concept of algorithmic self-assembly is closely re- 
lated to that of Wang tiles. Wang showed that square 
tiles with colored edges can emulate a Turing machine, 
if they are allowed to assemble in a way that would 
cover the plane, according to additional rule that edges 
of the same color have to face each other (TH) . This can 
be intuitively understood by thinking of a given row 
of tiles as representing a state of the Turing machine 
while the color encoding plays the role of the matching 
rules. This shows that computing using Wang tiles is 
universal fj]| 

2.2 Physical Implementation of Wang 
Tiles 

Recent advances in the field of materials science have 
enabled the experimental study of algorithmic self- 
assembly (abbreviated as ASA in the following). The 
first system, studied by Rothemund [fL2[ , was made of 
tiles whose edges were coated with materials of different 
hydrophobicity. The error rate was found to be unac- 
ceptably high, even though some expected distinctive 
features were observed. We remark that the hydropho- 
bic/hydrophilic interaction used in these experiments 
was probably not specific enough to enforce proper edge 
matching (despite some very clever "ad-hoc" tricks used 
by the author). More recently Mao et al. M have shown 
that nanoscopic tiles can be manufactured using DNA 
that are the molecular equivalent of Wang tiles. These 
"Triple Crossover" tiles are made of several strands of 
DNA interwoven to create a square body made of DNA 
double helixes with single (reactive) strands of DNA 
sticking out from each edge of the tile. In the fol- 
lowing we will refer to those single strands of DNA 
as sticky ends because they have the ability to bind 
to their Watson-Crick complement. This mechanism 
corresponds to the color matching rule in the abstract 
Wang tiles system. The experimental investigation fo- 
cused on the XOR operation of two binary strings. The 
size of the problem was still relatively small, but the 
result turned out to be promising, with an error rate 
that was less than 2%. Therefore DNA seems to be 
the material of choice to implement ASA on a wider 
scale. Indeed, materials scientists have achieved a high 



degree of control over the nanostructures that can be 
built using DNA, and the interaction between single 
strands of DNA seems to be specific enough to enable 
a self-assembly with an acceptable error rate. 

2.3 Our Perspective: Algorithmic Self- 
Assembly for Practical Problems 

Even though ASA is universal, it does by no means fol- 
low that any problem can be practically addressed by 
this approach. Indeed, traditional DNA computing is 
also universal but, as mentioned above, the quantity 
of materials needed to perform a calculation prevents 
it to be used for anything but toy problems. Why is 
there any reason to believe ASA is a more interesting 
approach? The answer lies in the fact that DNA tiles 
can be more easily "programmed" to incorporate the 
constraints of a given problem. It is therefore possible 
to exercise some degree of control over the biochemical 
reaction occurring in the test tubes, thus avoiding the 
considerable waste of materials that characterize the 
traditional approach. Given the recent experimental 
developments mentioned above, we believe it is timely 
to reflect on the best use that could be made of ASA 
for practical purposes. Our approach is resolutely con- 
structive: we try to provide examples where ASA turns 
out to be a practical way of solving otherwise difficult 
problems. This means that we have to depart from 
the only geometry that has been studied so far (square 
with four sticky ends). We give examples where a bigger 
number of sticky ends or a self-assembly not constrained 
to proceed in a plane turn out to be advantageous. To 
use a very bold analogy, this is reminiscent of the com- 
mon situation in traditional computer science where a 
problem is straightforward to program in a given lan- 
guage (say C) while it is hard to address in another one 
(say assembly) []. 

3 Mathematical Operations in 
DNA 

In this section we describe how to perform mathemati- 
cal operations in DNA for two examples. First we show 
how to execute a multiplication in 2D. Then we intro- 
duce a method to carry out ASA in three dimensions 
to execute a cyclic convolution product. We give an 
abstract overview of each operation, and then go more 
into details. Note that we did not do any practical ex- 
periments. 



1 The analogy breaks down pretty quickly as one tries to give 
it a more formal shape, but we hope it is still useful to carry our 
message. 
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3.1 Multiplication 

We implement the schoolbook method as shown in Fig- 
ure [I]. As example we use a multiplication of two 3-bit 
numbers. The binary input is given as vectors a and b 
with result r as sum of the corresponding rows under 
respect of carry overs. The spatial layout of the DNA 
after self-assembly is very similar to that of electronic 
circuits carrying out the same function ||. 
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Figure 1: Multiplication schoolbook method. 

Figure || depicts the basic DNA tiles that are needed. 
Tile (1) is used for the actual execution. The original 
binary operand values are represented by a and b while 
s and c represent the intermediate sum and carry over, 
respectively. The result of this elementary operation, 
intermediate value and carry over, are denoted by s' 
and c'. It follows that 

c! = (ab + c+ s) /2, s' = (ab + c+ s) mod 2 

where integer division is used. There are 16 different 
input values determining the number of different tiles 
of this kind. Tiles (2) and (5) are used to represent 
operand bits. The connection to the next and previous 
input tile is denoted by j, while the final result of a 
column is connected at r. Tile (3) represents a result 
bit which will connect to the sticky end r of input tile 
(5) and the sum s' of tile (1). Furthermore we use frame 
tiles to limit the physical expansion of the execution. 
Frame tile (4) forwards the carry over value c to the 
next left column. Further auxiliary tiles are used (start 
and end). 



1. 

(b,cV 



Body 



Frame 



2. 

^b,c) 

a 

y 5. 

c (b,0) 



Input 



s' 







r 

Input 



J J 

Figure 2: DNA tiles for multiplication. 



Figure || shows the arrangement of the DNA tiles to 
perform a multiplication. Note that we pad the second 
operand b with 0-bits to make reading of the result eas- 
ier, and that the result tile connected to bo is not part 
of the result. The body tiles are denoted by Vi_j, input 
tiles as ai and bj respective, and frame tiles by F. Ex- 
tra tiles are needed as starting and end point, denoted 
as S and E. We understand that different kind of tiles 
need different sticky ends to avoid ambiguity. However, 
there are enough combinations available ||]. It is clear 
that this method can be applied to bigger operands, 
and that it does not require the operands to have the 
same length. 




Figure 3: Multiplication in DNA. 

So far we have assumed that linear assemblies of in- 
put tiles could be readily obtained. We now outline 
the way these inputs are "synthesized" . Given a bi- 
nary string of N bits, we need 2N different tiles in- 
dexed by their value (0 or 1) and their position within 
the string (the DNA sequence connecting one digit to 
the next one is of course unique for each pair of value 
and position). Creating a given input simply consists 
in picking out N such tiles with different indices. Note 
that, given the appropriate supply, if all the 2N tiles 
are mixed together it is possible to obtain the 2 N possi- 
ble binary strings in a combinatorial fashion. By using 
non-identical concentrations for the two possible val- 
ues at a given position, it is also possible to induce a 
probability distribution on the input strings. All in all, 
prior to any calculation involving two strings of length 
m and n, we need to synthesize sets of m + n different 
input tilesfl 16 body tiles, 4 + 2 frame tiles, 2 result 
tiles, 3 end tiles, and 1 starting tile. Once the input 
strings have been synthesized our scheme requires only 
one reaction step. All the basic types of tiles are mixed 
together and the self-assembly can proceed. Reading 
the final result could be done using the reporter strand 
technique described in M . We note that in our case the 



2 Note that combinatorial a and b requires B(m+n) tile classes 
where B is the base of a and b, i.e., 2(m + n) for binary repre- 
sentation. 
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reporter strand would have to run through the entire 
2D lattice. Alternatively, one could imagine that each 
result tile would have a sticky end running perpendicu- 
lar to the plane of self-assembly. This would allow the 
formation of a linear self-assembled structure above this 
plane, that could be used to produce a reporter strand 
whose size would scale linearly with the size of the solu- 
tionQ. Thus, even in the worst case, our multiplication 
scheme requires only two reaction steps and the num- 
ber of different tiles required is growing linearly with 
the size of the problem. 



3.2 Cyclic Convolution Product 

After showing an example of ASA using relatively com- 
plex tiles to produce a straightforward 2D self-assembly, 
we now introduce an operation which can be performed 
more conveniently in 3 dimensions. First we define the 
cyclic convolution product. Let F — X^o 1 ^i x% ~ 
[Fq, . . . , Fn-i] be a polynomial or a vector of length N. 
Then the cyclic convolution product * of two vectors of 
length N is defined as ||: 

A-k B = C with 

k N-l 

Cfc = E AiBk-i + 22 AiB^+k-i 

i=0 i=k+l 
i+j = k mod N 

The * multiplication modulo q means that the coef- 
ficients Cfc are reduced by q. From now on we will 
focus on the modulo product. Figure ^ gives a geomet- 
rical description of the convolution product. The input 
operands are the vectors a and b. The x and y axis de- 
scribe the index of the operand bits. The figure shows 
the index k of Ck to which aibj contributes. By repeat- 
ing the input vector a the result coefficient Ck can easily 
be obtained by adding the diagonal elements. 





We execute the convolution product in DNA accord- 
ing to the geometry just outlined. First we assemble the 
elementary multiplications in a "ground layer" , then we 
grow the crystal to the third dimension to obtain the 
result. Figure || describes the body tile of the ground 
layer. It has two input ends a and b, forwards the input 
to the opposite side, and outputs the value ab using a 
sticky end pointing in the direction perpendicular to the 
plane of self-assembly ^. Figure || shows how the ground 
layer is built. Again we use input tiles, frame tiles, and 
start and end tiles. Note that the first operand a is 
fixed since it has to be repeated. 



a ^ 



Figure 5: Body tile for convolution product. 




Figure 6: Cyclic convolution product in DNA. 



Figure 4: Geometrical description of convolution prod- 
uct. 

3 Note that the first "dummy" result tile comes in handy as a 
PCR primer. 



To add the coefficients, we use bridges which are as- 
sembled for each layer beforehand. The implementa- 
tion of the bridges ensures that the result coefficients 

4 It is depicted as a circle in Figure Ejl 
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are modulo reduced. The bridges are built using con- 
nectors to the lower layer, a connector to the next layer, 
and spacer tilesj^. Bridges broken down into their con- 
stitutive tiles are shown in Figure |7[ 



2nd layer 

1 st layer 

ground 
layer 



Figure 7: Bridge to add the coefficients. 

The three dimensional arrangement of the bridges is 
shown in Figure |[ The bridges are arranged on top of 
the ground layer as outlined in Figure g. The dark 
grey connections represent bridge connections in the 
first layer, while the light grey connections stand for 
second layer bridges. 
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Figure 8: Bridges in the 3D space (connections in the 
ground layer are not pictured for simplification). 

To simplify the bridge building operation we assume 
that the operands have a length which is a power of 2. 
To force the bridges to operate along the appropriate 
diagonal, it would be necessary to use a 2D lattice with 
a lower symmetry than the square symmetry used for 
convenience in Figure ^| ^. The result of the operation 
can now be read at the sticky ends of the uppermost 
layer. The coefficient Cn-i appears twice and has to be 
ignored once. The diagonals which we do not consider 
will not assemble up to the highest layer. 



5 whose number depends on the layer under consideration 
6 To prevent that bridges are attached to the wrong tiles such 
that at some sticky ends there is no bridge attached at all one 
could use input tiles for a with alternate length in between. 



Note that input coefficients are integers instead of bi- 
naries. Therefore the number of tiles needed is much 
larger than for the multiplication. Let a, S {0, . . . , s — 
1} and bj £ {0, . . . , t — 1}. Synthesis of the input tiles 
requires 2N + N tile classes. Fixed a and combina- 
torial b requires 2N + tN tile classes though. Includ- 
ing start, end, frame, input, and body tiles we need 
l + 3 + 4 + 2N+N + st = 8 + 3N+st tile classes for the 
first layer. Remember that the bridge tiles perform ad- 
dition modulo q. Therefore we need q 2 different bridge 
combinations, i.e., q 2 connector tiles to the upper layer 
and 2q connectors to the lower layer. Furthermore we 
need spacer tiles to build the bridges. Assuming that q 
is considerably larger than s and t the number of dif- 
ferent tiles is in the order of q 2 even for combinatorial 
b. If N — 2 X then our structure will consist of x + 1 
layers including the ground layer. Each layer will be 
grown one at at time, using bridges with the appropri- 
ate spacing. The final result will therefore be obtained 
in x + 1 steps. 

3.3 More Practical Considerations 

The first problem that needs to be addressed is that of 
the error rate during a computation. Theoretical con- 
siderations taking into account the thermodynamics of 
the system are clearly outside of the scope of this paper, 
and we will therefore only lead a qualitative discussion. 
The process of self-assembly within a plane, that we use 
for our multiplication scheme and as the first step in our 
cyclic convolution product, is in essence very similar to 
the construction of Mao et al. for their XOR product. It 
is therefore likely that an experimental error rate below 
2% could be expected. Much higher error rates could 
be expected for the building of the successive layers in 
our convolution product because cooperativity is much 
lower in this direction (the number of neighbors is much 
lower which means less constraints). This would prob- 
ably require the interaction energies between the sticky 
ends in this direction to be relatively high, in order to 
give a maximum energetic penalty to possible "orphan" 
sticky ends. 

Any reader familiar with materials science will prob- 
ably already have more than a few objections to our 
claims. Indeed, we must acknowledge that, to date, no 
DNA tile has been synthesized that could be used to 
implement our schemes directly. To what extent this 
will be true in the future is of course absolutely im- 
possible to tell. We will simply refer the reader to the 
recent work accomplished by the group of Seeman Jll|] 
on the creation of DNA-based nanostructures and let 
him decide for himself how far experimental science is 
from being able to implement our ideas. We do not 
believe that our computation schemes alone would be 
enough to motivate the considerable experimental work 
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required to investigate the 3D ASA of DNA. But we 
should note that this technique is also very promising 
for the much more researched problem of protein crys- 
tallization. It is therefore not completely utopic to ex- 
pect experimental progress on that front. Also, even 
though the total number of different types of tiles to be 
synthesized is not overwhelming and certainly within 
the reach of combinatorial chemistry techniques, even 
for operations on binary numbers of a few hundred bits, 
it remains to be seen which incentive an experimental- 
ist could have to perform such an experiment. That's 
why we devote the next section of this article to show 
that it might be possible to implement an attack on a 
strong public-key crypto system using our strategy for 
the cyclic convolution product. 

4 Application to Cryptography 

In the mid 90's it was shown that DNA computing can 
be applied to break DES ^ EL These methods are 
based on a brute force attack. Using the parallel na- 
ture of DNA computing all possible keys are tested. For 
symmetric encryption ciphers like DES a brute force 
attack often is the only practical attack due to lim- 
ited knowledge. However, for public-key methods brute 
force attacks are usually far out of computing power 
range because the key length is chosen according to the 
best known attack, which requires much less effort than 
brute force. DNA attacks are limited by the complexity 
of an attack step and the amount of DNA. In the fol- 
lowing we will present the public-key system NTRU and 
a simple brute force attack in DNA. Then we present 
the execution of an attack on NTRU which reduces the 
amount of DNA by the square root. DNA tiles provide 
the appropriate flexibility to implement both attacks. 

4.1 Overview of NTRU 
4.1.1 Notation 

In this section we will give a brief overview of NTRU. 
For further details see §. The NTRU system is based 
on a ring R = Z/(X N — 1) , three integers (N,p, q) and 
four sets Cf,C g ,C,p, C m of polynomials of degree N — 1 
with integer coefficients. We assume that gcd(p, q) = 1, 
and that q is considerably larger than p. Elements F G 
R are written as a polynomial or vector 



F 



JV-l 

£ 

j=0 



F,x l = [F ,F u ...,F N -i] 



Multiplication in R is done using the cyclic convolu- 
tion product * as defined in Section 3.2. Multiplication 
modulo q means that the coefficients of the convolution 
product are reduced modulo q. 



4.1.2 Key Creation 

Assume two entities called Bob and Alice who want to 
exchange messages over an insecure channel. First Bob 
chooses elements f & Cf and g G C g . For simplicity 
we assume that / has coefficients in {0, 1} and that 
g has coefficients in {0, ldots,s — I}. The polynomial 
/ is chosen such that it has exactly d coefficients of 
value I and N — d coefficients of value 0. Bob computes 
fq 1 = / _1 mod q and h = f~ 1 *g mod q. Bob's private 
key is the polynomial / and his public key is h. 



4.1.3 Encryption 

To encrypt a plain text message m G C m using Bob's 
public key h, Alice selects a random element r G £<p 
and computes the cipher text e = (r * h + m) mod q. 

4.1.4 Decryption 

To decrypt the cipher text e using the private key /, 
Bob first computes a = f*e mod q where he chooses the 
coefficients of a in the interval from — q/2 to q/2. Now 
Bob recovers the plain text message as m = (f^ 1 mod 
p) * a mod q. 

4.2 Brute Force Attack 

The goal of the attack is given all parameters (N,p, q), 
the sets Cf,C g ,C$,C m , and a public key h to recover 
the private key /. Let us assume that polynomials in 
C g have coefficients in {0, . . . , s — I}. As before any 
/ G Cf has d coefficients of value I and N—d coefficients 
of value 0. An attacker can recover the private key by 
trying all possible / G Cf and testing if g' = f-kh mod q 
has small entries, i.e., if the coefficients are between 
and s — 1. Similarly, an attacker can try all g G C g 
and test if /' = g-kh^ 1 mod q has only coefficients or 
1. In practice, C g is smaller than Cf, so the security is 
determined by the number of elements in C g . 

The attack can be implemented in DNA as follows. 
For all g € C g compute the cyclic convolution product 



g-kh 1 mod q as explained in Section 3.2. Choose h 



as the operand which is repeated. Use the massive par- 
allelism of DNA to compute the convolution product of 
h^ 1 with all the possible g. Reading of the operation 
result is done by the reporter strand method. Among 
all the results, the one consisting only of or I f\ is the 
private key. To get it we need to run q — 2 separation 
steps. 

This attack does not scale up well. It is limited by 
q which determines the number of different tiles. A 
typical value for q is 64 or 128 || which means that 
more than 4,000 different tile classes are needed. An- 
other restriction is given by the total amount of DNA. 



7 Remember that each digit of the result can take q values. 



G 



The number of DNA tiles to be used in the compu- 
tation cannot be expected to be much more than the 
Avogadro number (about 10 23 ). Therefore this kind of 
attack is roughly limited to 2 80 different possibilities for 
g. Since the coefficients of g are not limited to binary 
values there can be 2 80 different possible polynomials 
of length 64. Usually the key space is defined as the 
set of possible keys. In our case we extend the defini- 
tion such that the key space is the set which is used 
for an attack, i.e., for NTRU this is usually C g since it 
is smaller than £/. The key security is defined as the 
number of steps, or in our case different inputs, that 
have to be performed or tried before the key is found 
using the best known attack. The best known attack is 
shown in the next section and reduces the effort by a 
square factor, i.e., the key security is the square root of 
the number of elements in the key space. Thus we can 
break an NTRU system having a key security of 2 40 for 
a proper value s. However, a typical key security for 
NTRU in high security scenarios is about 2 80 , i.e., C g 
has 2 160 elements. In the next section we give a future 
perspective how this can be achieved. 

4.3 Meet-in-the-Middle Attack 

The meet-in-the- middle attack reduces the effort to find 
the private key. Compared to a brute force attack this 
attack reduces the amount of DNA which is required 
for a successful attack by the square root, or in other 
words the key space which can be broken is quadratic 
in size. We will give a brief overview of the attack. 
Detailed information is given in jL4j. Remember that 
the private key / has exactly d ones and N — d zeros. 
The idea of the attack is to search for / in the form 
(/ij/2) where /1 and ji each have d/2 ones and are 
N/2 in length. Then try all possibilities for fi and fa 
such that /i) * h mod q has coefficients between 
and s — 1. This can be done efficiently as follows. 

Choose at random N/2 of the N possible positions in 
/. Assume that d/2 of these N/2 positions have ones 
in the actual private key /. The probability that this 
assumption holds is approximately I to ^/d, so the fol- 
lowing has to be repeated around Vd times before / 
is found. Now relabel the positions such that the cho- 
sen N/2 positions determine the vector /1 and the other 
N/2 positions fa. The next step is to enumerate over f±. 
Usually this takes only (^73) steps but in DNA we prob- 
ably have to iterate over all 2 N / 2 binary vectors. Since 
d is chosen such that the key space is very large the 
relative difference is very small. First (/1 , 0) * h mod q 
is computed and put into a bin based on its first k co- 
efficients. If the convolution product has coefficients 



ues for /2 are enumerated. The convolution product 
— (0, f2)*h mod q is put into a bin (J,- , . . . , Jj k _ x ) that 
is defined by intervals that are slightly larger as the 
previous ones (each bin is exactly by s-I larger). Fi- 
nally the bins are compared. If the assumption about 
the position of the ones in / in the first step was right 
then there is a matching pair f\ and ji such that /1 



is in (/ 



JO I ■ 



Jj fc -i) and h in (Jjo,- 



Jj k _ 1 ), and the 
private key can be derived as f — (fi, fi). 

In DNA the attack is executed as follows. First 
choose N/2 random positions in /. The marked po- 
sitions are represented by f\ which is assembled using 
DNA tiles such that the marked positions are chosen 
combinatorial and the unmarked positions are set to 
0. This can easily be done by encoding the position 
into the DNA tiles that represent /1 as described be- 
fore. Execute (/1, 0) * h mod q in parallel for all possi- 
ble combinations of /1 as explained in Section ^2. The 
polynomial h is the fixed operand which is repeated. 
Now construct DNA tiles for fi in the same manner 
as before but set marked bits to and iterate over un- 
marked bits, and execute —(0, fi) * h mod q. To put a 
product into a bin we use special DNA tiles with two 
sticky ends that translate an integer value into the cor- 
responding interval. These tiles are different for the 
two convolution products in the sense that the interval 
sizes are different. Tiles for the first convolution prod- 
uct can connect to tiles for the second product with the 
same intervals, i.e., tiles representing Ij i will be glued 
to tiles representing Jj t . Apply these tiles to the con- 
volution products. Assuming that the mobility of the 
DNA supra molecular assemblies is not too small, two 
of them will stick together. If such a tandem struc- 
ture can be found the original assumption was right, 
and the private key can be determined by reading the 
input tiles f\ and fi. The actual reading stage is prob- 
lematic here, as the reporter strand method likely does 
not seem to work. We suggest another approach where 
the DNA structures are first filtered according to their 
molecular weight, and those corresponding to tandem 
units are examined by atomic force microscopy^. 

Assuming that a brute force attack can be mounted 
to break a key security of 2 40 the described meet-in- 
the-middle attack in DNA might break systems with 
a key security of 2 80 . However, many assumptions are 
very optimistic for the near future. Furthermore we 
understand that using a higher security level, e.g., a 
key security of 2 285 as proposed in || puts public-key 
systems like NTRU far out of range for a successful 
cryptanalysis in DNA. 



Fq 7 . . . , Fk-i then it is put into a bin (Jj, 



1 Ijk-i ) 



where Ij t D Fi are integer intervals. The size of the 
intervals are determined by k. Then all possible val- 



8 If the recent developments in coupled NMR and AFM become 
mainstream, then reading could be done by coordinating atoms 
with very different resonance frequencies to the input tiles. 
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5 Conclusions 

We have presented two computation schemes for the 
binary multiplication and cyclic convolution product 
using the algorithmic self-assembly of DNA tiles. For 
that purpose, we introduced new conceptual designs for 
DNA tiles that should allow for a practical implementa- 
tion of these operations. Indeed, we emphasize the fact 
that even though DNA tiles are by themselves universal, 
tiles with different designs will perform very differently 
on a given problem: designing effective DNA tiles for a 
given computation can be thought as "DNA program- 
ming". The most interesting feature of our system of 
DNA tiles is that it turns out to be flexible enough to 
go beyond a simple brute force algorithm: it would in- 
deed be possible to use it to implement an attack on a 
public-key crypto system. Among the open questions, 
we have to acknowledge that we do not have any esti- 
mations on the expected error rate. We are currently 
trying to address this issue. 
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